Only 8 of 27 EU Member States Are Ready to Enforce the AI Act as the August Deadline Nears
Four months before the EU AI Act's core provisions take effect, the European Commission's public register shows that only eight of 27 member states have designated the national authorities required to enforce it.
Overview
With less than four months to go before the core provisions of the European Union’s AI Act become applicable on 2 August 2026, the regulation’s enforcement machinery remains visibly incomplete. The European Commission’s own public register of market surveillance authorities lists only eight of the bloc’s 27 member states with designated or pending national authorities to police the law, eight months after the deadline for doing so passed. In parallel, the European Parliament has voted to postpone the most sensitive obligations to 2027 and 2028 under the Digital Omnibus package.
The picture that emerges from official EU sources is not one of a regulation being softened purely through political compromise, but of an enforcement framework struggling to come into existence at all. Even if the August date survives the ongoing trilogue negotiations unchanged, much of the administrative plumbing required to turn the law into practical oversight is not yet in place.
The Article 70 Gap
Under Article 70 of the AI Act, every EU member state is required to designate at least one notifying authority and at least one market surveillance authority, with one of them acting as a national single point of contact for the regulation. The original deadline for these designations was 2 August 2025.
The public register the Commission maintains on its digital strategy portal shows how uneven compliance with that deadline has been. The Commission’s official list of market surveillance authorities under the AI Act identifies only five member states with fully designated authorities — Cyprus, Ireland, Italy, Latvia and Lithuania — plus three more, Luxembourg, Slovenia and Spain, with designations marked as pending. The remaining 19 EU member states show no designated market surveillance authority on the page at all. Many of the bloc’s largest AI markets, including several where major U.S. providers have located their EU operations, are among those that do not yet appear with a finalised single point of contact.
The Commission has the formal option, laid out on the same page, to open infringement proceedings against member states that fail to designate in time. As the Commission’s market surveillance page puts it, “if the Member States fail to designate a market surveillance authority by that date, the Commission may launch a formal infringement procedure.” So far, no such proceedings have been announced in relation to Article 70.
What Takes Effect on 2 August 2026
The AI Act’s general application date of 2 August 2026 is not the start of the regulation — several provisions, including the prohibitions on “unacceptable-risk” practices and the AI literacy obligations, already became applicable on 2 February 2025, and the obligations on providers of general-purpose AI models kicked in on 2 August 2025. But the August 2026 date is still the single most important moment in the law’s lifecycle. According to the Commission’s overview of the AI Act, that is when “the majority of rules of the AI Act come into force and enforcement starts,” including rules for high-risk AI systems and transparency obligations for generative AI. The same page confirms that enforcement is shared between a new European AI Office and national authorities, with the latter responsible for post-market surveillance on the ground.
For most of the Act’s high-risk regime, national authorities are therefore the indispensable enforcement layer. Without them, there is no one positioned to open investigations, request technical documentation, or demand corrective action from providers and deployers operating inside a given member state. The Commission’s AI Office has exclusive competence over general-purpose AI models, but the regulation of, say, a hiring system used by a company in a country without a designated single point of contact depends on infrastructure that does not yet formally exist.
Service Desk as a Stopgap
To help providers and deployers navigate the period before national authorities are fully operational, the Commission has invested in centralised support channels. On its overview page for the AI Act, the Commission points stakeholders to an AI Act Service Desk and Single Information Platform, alongside published guidelines and codes of practice. These resources are explicitly presented as support mechanisms to help organisations prepare for the August 2026 deadline, rather than as substitutes for the enforcement responsibilities that national authorities are meant to assume.
In practical terms, without fully operational national market surveillance authorities in most member states, a company that wants clarity on how a specific high-risk AI system will be treated has limited recourse beyond these central Commission channels. Post-market investigations, document requests and corrective action orders all depend on member-state-level bodies that, according to the Commission’s own list, in many countries do not yet formally exist.
The Digital Omnibus Vote and What It Changes
Against this background, the European Parliament adopted its negotiating position on the Digital Omnibus on AI on 26 March 2026. The final plenary vote, held in Strasbourg, came out at 569 in favour, 45 against and 23 abstentions, according to the Parliament’s own press release. The Council of the EU had already adopted its general approach on 13 March. Both institutions now head into trilogue negotiations aimed at concluding a deal well before August.
On timing, Parliament and Council largely converge. Under the Parliament’s position, the application date for high-risk AI systems listed in the AI Act itself — covering areas such as biometrics, critical infrastructure, law enforcement, border management and the administration of justice — would move from 2 August 2026 to 2 December 2027. High-risk AI systems falling under existing EU sectoral safety legislation, such as medical devices, radio equipment and toy safety rules, would not need to comply with the AI Act’s requirements until 2 August 2028. Transparency rules on the marking of AI-generated audio, images, video and text would apply from 2 November 2026. Parliament also introduced a new prohibition targeting “nudifier” systems that generate sexually explicit imagery of identifiable individuals without their consent, with an exemption for systems that demonstrate effective safety measures.
The Parliament further extended several flexibility measures originally designed for small and medium-sized enterprises to small mid-cap companies, and relaxed some AI Act obligations for products that are already covered by sectoral EU laws. The stated rationale, in the Parliament’s own framing, is to simplify implementation and reduce administrative burden on AI providers and deployers in Europe.
This follows a pattern previously reported by The Machine Herald, which traced the emerging political consensus in Brussels around delaying the high-risk regime and introducing the non-consensual intimate imagery ban. What the new enforcement-readiness data adds is a reason to take the delay less as a pure political choice and more as a reflection of what member states are actually able to implement.
Legal Status and the Gap to Official Journal
Crucially, the Digital Omnibus remains a legislative proposal. Until trilogue negotiations conclude and the final text is formally adopted by Parliament and Council and published in the Official Journal of the European Union, the original AI Act timeline continues to apply as a matter of law. Providers and deployers that assume the delay is already in force, and design their compliance strategies around December 2027 or August 2028, are betting on a political outcome that has not yet happened.
At the same time, the Commission’s own register suggests that the practical August 2026 effect will be uneven even if the original deadline holds. Member states that already appear on the public list of market surveillance authorities are in a position to begin exercising their supervisory powers as soon as the relevant provisions apply. Member states that do not yet appear with a designated authority are not, and companies operating across multiple jurisdictions face the prospect of significantly different enforcement intensities depending on where their activities are based.
What We Don’t Know
Several important variables remain unresolved. The exact sequencing of the trilogue is still subject to change, with the next plenary and Council stages not yet fixed at the time of writing. It is also not yet known whether the Commission will open Article 70 infringement proceedings against the member states that remain non-compliant on designation, or continue to rely on political pressure and technical assistance. How quickly the member states that appear as “pending” on the Commission’s list — Luxembourg, Slovenia and Spain — will finalise their designations, and how quickly the 19 member states with no authority listed at all will move forward, is another open question that will shape the real-world texture of compliance in the second half of 2026.
What is clear from the Commission’s own materials is that the European AI Act’s first major enforcement milestone is arriving on a partially built road. The political fight over whether to delay high-risk obligations, visible in the Digital Omnibus vote, is taking place on top of a more structural question: whether the EU’s decentralised enforcement model — 27 national authorities plus a central AI Office — can be stood up quickly enough to make the regulation operationally meaningful when the August 2026 date finally arrives.